Code injection

The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages...

CVE-2019-16216

Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack...

CVE-2019-16216

Zulip server before 2.0.5 incompletely validated the MIME types of uploaded files. A user who is logged into the server could upload files of certain types to mount a stored cross-site scripting attack on other logged-in users. On a Zulip server using the default local uploads backend, the attack...

CVE-2019-16216

Zulip server before 2.0.5 (local uploads) and before 2.0.5 (S3 uploads) mishandled MIME type validation for uploaded files, enabling a stored XSS across logged-in users. On local uploads, the attack affects browsers without CSP support (e.g., IE11); on S3, the impact is limited to the configured ...

CVE-2019-16215

The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages...

CVE-2019-16215

CVE-2019-16215 affects the Zulip server before 2.0.5. The Markdown parser uses a regular expression vulnerable to exponential backtracking, allowing a logged-in user to craft a message that could cause the server to consume excessive CPU time and stall processing of subsequent messages. The Red H...

CVE-2019-16215

The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages...

PT-2019-14585 · Zulip · Zulip Server

Name of the Vulnerable Software and Affected Versions: Zulip server versions prior to 2.0.5 Description: The issue concerns the Markdown parser in the Zulip server, which used a regular expression vulnerable to exponential backtracking. This could allow a logged-in user to send a crafted message,...

PT-2019-14586

Name of the Vulnerable Software and Affected Versions Zulip server versions prior to 2.0.5 Description The issue allows a logged-in user to upload files of certain types, potentially leading to a stored cross-site scripting attack on other logged-in users. The effectiveness of the attack depends ...

CVE-2019-16215: Inefficient Regular Expression Complexity

The Markdown parser in Zulip server before 2.0.5 used a regular expression vulnerable to exponential backtracking. A user who is logged into the server could send a crafted message causing the server to spend an effectively arbitrary amount of CPU time and stall the processing of future messages...

Zulip Server Cross-Site Scripting Vulnerability (CNVD-2018-08600)

Zulip Server is a set of open source group chat application written in Python based on the Django framework . frontend markdown processor is one of the front-end markdown markup language processor . A cross-site scripting vulnerability exists in the frontend markdown processor in Zulip Server...

Zulip Server Cross-Site Scripting Vulnerability (CNVD-2018-08598)

Zulip Server is a set of open source group chat application written in Python based on the Django framework . A cross-site scripting vulnerability exists in versions of Zulip Server prior to 1.7.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Zulip Server Cross-Site Scripting Vulnerability (CNVD-2018-08599)

Zulip Server is a set of open source group chat application written in Python based on the Django framework . A cross-site scripting vulnerability exists in Zulip Server versions 1.5.x, 1.6.x, and 1.7.x before 1.7.2. A remote attacker can exploit this vulnerability to inject arbitrary web script ...

Zulip Server Cross-Site Scripting Vulnerability

Zulip Server is a set of open source group chat application written in Python based on the Django framework . A cross-site scripting vulnerability exists in versions of Zulip Server prior to 1.7.2. A remote attacker can exploit this vulnerability to inject arbitrary web script or HTML...

Cross site scripting

In Zulip Server versions before 1.7.2, there was an XSS issue with user uploads and the default LOCALUPLOADSDIR storage backend...

CVE-2018-9986

In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...

CVE-2018-9990

In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead...

Cross site scripting

In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...

CVE-2018-9986

In Zulip Server versions before 1.7.2, there were XSS issues with the frontend markdown processor...

CVE-2018-9990

In Zulip Server versions before 1.7.2, there was an XSS issue with stream names in topic typeahead...